CompTIA CySA+ (CS0-003)Security OperationsEasy
A network security analyst observes the following log entries from a firewall: ``` TIME: 2023-10-26 10:05:12 SRC: 192.168.1.10 DST: 172.16.1.5 PROTO: TCP SPORT: 52345 DPORT: 23 ACTION: DENY TIME: 2023-10-26 10:05:13 SRC: 192.168.1.10 DST: 172.16.1.6 PROTO: TCP SPORT: 52346 DPORT: 23 ACTION: DENY TIME: 2023-10-26 10:05:14 SRC: 192.168.1.10 DST: 172.16.1.7 PROTO: TCP SPORT: 52347 DPORT: 23 ACTION: DENY TIME: 2023-10-26 10:05:15 SRC: 192.168.1.10 DST: 172.16.1.8 PROTO: TCP SPORT: 52348 DPORT: 23 ACTION: DENY ``` Which type of attack is most likely indicated by these logs?
- ASQL Injection
- BPort Scan
- CDistributed Denial of Service (DDoS)
- DMan-in-the-Middle (MitM)
Show answer & explanationAnswer & explanation
Correct answer: B. Port Scan
The logs show a single source IP (192.168.1.10) attempting to connect to multiple different destination IPs (172.16.1.5, 172.16.1.6, etc.) on the same destination port (23, Telnet), with all attempts being denied. This pattern indicates a port scan, specifically targeting a range of hosts on a particular port to discover open services.
Why the other options are wrong
- A. SQL injection targets web applications and involves injecting malicious SQL queries, which is not reflected in these network-level firewall logs.
- C. DDoS involves multiple source IPs attacking one or more targets, which is contrary to the single source IP shown here.
- D. MitM attacks involve intercepting communication between two parties and would typically manifest in different log anomalies, such as certificate warnings or unusual routing, not sequential denied connections to different hosts.
Port Scan
A port scan is an attack or reconnaissance technique used to identify open ports and services on a network host or range of hosts. Attackers use this to map out the network's attack surface.
- Involves sending connection requests to a range of ports or hosts.
- Used for reconnaissance to find vulnerabilities.
- Can be detected by firewalls or intrusion detection systems.
Memory trick: Scanning ports is like peering through many windows to find an open door.